# ScreenConnect Masked as Freeware: Large-Scale AsyncRAT Distribution Campaign via SEO-Poisoned Fake Software Sites

> Since October 2025, an unattributed threat actor has run a large-scale SEO-poisoning campaign across 90+ fraudulent, localized websites spoofing 25+ popular free tools (OBS Studio, VLC, DS4Windows, Bandicam, Process Hacker, Glary Utilities, and others) to deliver trojanized ScreenConnect installers bundled with a custom AsyncRAT build. Kaspersky (Securelist) and NCC Group/FOX-IT independently tracked the operation, which uses DLL sideloading, multi-stage VBS/PowerShell/JS droppers, in-memory .NET compilation, process hollowing into RegAsm.exe, UAC bypass, and Defender exclusion tampering to gain stealthy, persistent remote access to both individual users and corporate networks.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1040
- **ID:** TL-2026-1040
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 55 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The campaign begins with SEO-optimized, hreflang-tagged fake download portals (10+ localized languages: English, Russian, Chinese, German, French, Spanish, Arabic, and others) that impersonate 25+ legitimate freeware titles including OBS Studio, DNS Jumper, DS4Windows, Bandicam, Process Hacker, Glary Utilities, tModLoader, Defender Control, CrosshairX, VLC Media Player, KM Player, and LibreOffice. The pages use fabricated Schema.org ratings and distinct analytics/verification IDs to compartmentalize infrastructure and inflate search-result trust signals.

Victims download an archive containing a legitimate, Microsoft-signed `install.exe` alongside a malicious sideloaded library `install.res.1033.dll`, plus an Assets folder holding both the real requested freeware and a ScreenConnect (ConnectWise) remote-access installer disguised as MSI packages named `vcredist_x64.dll` / `vcredist_x86.dll`. Execution triggers a PowerShell script (`Fj5NmEsp9EuKrun.ps1`) that adds broad Microsoft Defender exclusions (all drives, system directories, RegAsm.exe) and flips the `ConsentPromptBehaviorAdmin` registry value to 0 to silently bypass UAC.

A VBScript dropper (`installer_method3_stream.vbs`) stages further payloads into `C:\Users\Public`, invoking `script.vbs`, which in turn triggers an obfuscated PowerShell stage (`cap.ps1`). That script parses `secret_bytes.txt` for `[SXX-` -tagged byte sequences, XOR-decrypts them (key 0xA7), reverses bit order, and reflectively loads the resulting .NET injector entirely in memory — leaving no dropped executable for static scanners. The in-memory injector performs process hollowing (T1055.012) into a suspended `RegAsm.exe` process to inject a non-stock AsyncRAT build that includes a cryptocurrency clipper, a dynamic runtime plugin-loading framework, and geofencing logic that avoids victims geolocated in the Middle East, North Africa, and Central Asia.

Persistence is established via a Scheduled Task (`MasterPackager.Updater`) that re-launches `script.vbs` every 2 minutes. ScreenConnect is configured against actor-controlled relay infrastructure (domains embedded in `system.config` XML: servermanagemen.xyz, r.manage-server.xyz, manageserver.xyz, winservec.net, cloudsynn.com, pingserv.pro, ehostservers.xyz, serverdnsplan.net), giving the operator an independent, dual-use legitimate RMM channel into the host alongside AsyncRAT's C2 (primary observed: mora1987.work.gd). Fake-software hosting is split across at least three infrastructure clusters (Dynu Systems/US, NOHAVPS LLC/US, dataforest GmbH/Germany), consistent with deliberate compartmentalization to survive partial takedowns. NCC Group and FOX-IT, working a related spike in ScreenConnect alerts, scoped a parallel/overlapping SEO-poisoning operation using the same ScreenConnect-abuse pattern to deploy a GPU cryptojacking payload, indicating the underlying distribution infrastructure/tooling is being reused or shared across multiple monetization payloads (AsyncRAT + cryptominer).

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1566.002 Spearphishing Link
- T1583.001 Domains
- T1587.001 Malware
- T1588.002 Tool
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1202 Indirect Command Execution
- T1569.002 Service Execution
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Bypass User Account Control
- T1055.012 Process Hollowing
- T1685 Disable or Modify Tools
- T1574.001 DLL
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1036.005 Match Legitimate Resource Name or Location
- T1218 System Binary Proxy Execution
- T1027 Obfuscated Files or Information
- T1112 Modify Registry
- T1219 Remote Access Tools
- T1082 System Information Discovery
- T1614.001 System Language Discovery
- T1056.001 Keylogging
- T1115 Clipboard Data
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking

## Sources

- [The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign](https://securelist.com/tr/the-soc-files-screenconnect-campaign-with-asyncrat/120472/)
- [SEO Poisoning Campaign Uses Fake Popular Apps to Deliver AsyncRAT](https://gbhackers.com/seo-poisoning-campaign/)
- [From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities](https://www.microsoft.com/en-us/security/blog/2026/05/26/poisoned-search-results-gpu-mining-cryptojacking-campaign-abusing-screenconnect-microsoft-net-utilities/)
- [SEO Poisoning Campaign Impersonates 25+ Popular Apps to Deliver AsyncRAT Since October 2025](https://cybersecuritynews.com/seo-poisoning-campaign-impersonates-25-popular-apps/)
- [SEO Poisoning Campaign Impersonates 25+ Popular Apps to Deliver AsyncRAT Since October 2025](https://www.cryptika.com/seo-poisoning-campaign-impersonates-25-popular-apps-to-deliver-asyncrat-since-october-2025/)
- [SEO Poisoning Campaign Impersonates 2025 Popular Apps To Spread AsyncRAT](https://cyberpress.org/seo-poisoning-spreads-asyncrat/)
- [SEO Poisoning Leads to ScreenConnect Cryptojacking](https://socprime.com/active-threats/from-poisoned-search-results-to-gpu-mining-a-cryptojacking-campaign-using-screenconnect-and-net-utilities/)
- [GPU-Targeted Cryptojacking Campaign Extends SEO Poisoning to AI Chatbots, Deploys Persistent ScreenConnect Backdoors](https://techjacksolutions.com/scc-intel/gpu-targeted-cryptojacking-campaign-extends-seo-poisoning-to-ai-chatbots-deploys-persistent-screenconnect-backdoors/)
- [Hackers Deploy AsyncRAT and SectopRAT Malware Using ScreenConnect on Windows](https://cybersecuritynews.com/hackers-deploy-malware-using-screenconnect-software-on-windows/)
- [Attackers abuse ConnectWise ScreenConnect to drop AsyncRAT](https://securityaffairs.com/182090/malware/attackers-abuse-connectwise-screenconnect-to-drop-asyncrat.html)
- [ASYNCRAT Malware Analysis: MITRE ATT&CK, IOCs & Detection](https://www.zerosday.com/post/malware/malware-analysis-asyncrat-2026-04-16)
- [AsyncRAT Malware: Analysis, Detection, Removal](https://www.huntress.com/threat-library/malware/asyncrat)
- [AsyncRAT C2 Framework: Overview, Technical Analysis & Detection](https://blog.qualys.com/vulnerabilities-threat-research/2022/08/16/asyncrat-c2-framework-overview-technical-analysis-and-detection)
- [AsyncRAT Crusade: Detections and Defense](https://www.splunk.com/en_us/blog/security/asyncrat-crusade-detections-and-defense.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1040